Add live integration tests, Render deployment, proxy rate limit fix

Integration tests (test_integration.py):
- Added 10 new live-network tests covering Sprint 2 and Sprint 3 features
  (tests 15-24): DNS resolve, enumerate, DNSSEC, DNSBL, email security,
  propagation, TLS inspect, CT logs, Shodan threat intel, RIPE PDNS
- Tests use real external APIs with no mocks; assertions are plausible-value
  checks (not fragile exact-value checks) with SKIP fallback for transient
  network issues
- Total: 24 live integration tests covering all 27 tools

api.py — proxy rate limit fix:
- Replaced get_remote_address (returns proxy IP behind Render/nginx) with
  _real_ip() which checks X-Forwarded-For → X-Real-IP → direct connection
- Prevents all users sharing one rate limit bucket when deployed behind
  a reverse proxy (Render, Cloudflare, nginx, etc.)

render.yaml — Render.com Blueprint deployment config:
- Web Service: uvicorn api:app, free plan, auto-deploy on git push
- Health check: /v1/meta/status
- Env vars: PEERGLASS_ALLOWED_ORIGINS (CORS), GREYNOISE_API_KEY (optional)
- Static Site section pre-written for Sprint 7 Web UI (commented out)
- Documents free tier limitations (sleep, cache wipe, no persistent storage)

requirements.txt:
- Added for pip-based deployment environments (Render, Railway, Heroku)
- Mirrors pyproject.toml dependencies

https://claude.ai/code/session_01HbqpFDHjFtjBm3Kf6e6YAp

Author: claude

api.py

@@ -49,7 +49,23 @@
 from slowapi.util import get_remote_address
 from slowapi.errors import RateLimitExceeded
 
-limiter = Limiter(key_func=get_remote_address)
+
+def _real_ip(request: Request) -> str:
+    """
+    Extract the real client IP, respecting X-Forwarded-For and X-Real-IP
+    headers set by reverse proxies (Render, nginx, Cloudflare, etc.).
+    Falls back to direct connection address if no proxy headers are present.
+    """
+    forwarded_for = request.headers.get("X-Forwarded-For")
+    if forwarded_for:
+        return forwarded_for.split(",")[0].strip()
+    real_ip = request.headers.get("X-Real-IP")
+    if real_ip:
+        return real_ip.strip()
+    return get_remote_address(request)
+
+
+limiter = Limiter(key_func=_real_ip)
 
 import rir_client
 import cache as cache_module

render.yaml

@@ -0,0 +1,76 @@
+# render.yaml — PeerGlass deployment on Render.com
+# Docs: https://render.com/docs/blueprint-spec
+#
+# Deploy instructions:
+#   1. Push this repo to GitHub
+#   2. Go to https://dashboard.render.com → New → Blueprint
+#   3. Connect your GitHub repo — Render auto-reads this file
+#   4. Set GREYNOISE_API_KEY in the dashboard (optional, for threat intel)
+#   5. Done — API is live at https://peerglass-api.onrender.com
+#
+# Architecture on Render:
+#   ┌─────────────────────────────────────────────┐
+#   │  peerglass-api  (Web Service — Python)       │
+#   │  uvicorn api:app   →   /v1/ip, /v1/dns, …   │
+#   │  Auto-deploys on every git push to main      │
+#   └─────────────────────────────────────────────┘
+#   ┌─────────────────────────────────────────────┐
+#   │  peerglass-ui  (Static Site — Sprint 7)      │
+#   │  React + Vite build → dist/                  │
+#   │  Note: uncomment when Web UI is built        │
+#   └─────────────────────────────────────────────┘
+#
+# IMPORTANT LIMITATIONS on free tier:
+#   - Service SLEEPS after 15 min of inactivity → ~30s cold start
+#   - In-memory cache (cache.py) is wiped on sleep/redeploy
+#   - Change monitor baselines are lost on sleep
+#   - Upgrade to Starter ($7/mo) for always-on with persistent cache
+#
+# MCP stdio server (server.py) is NOT deployable here —
+# it runs locally inside Claude Desktop as a stdio subprocess.
+
+services:
+  # ── REST API ─────────────────────────────────────────────────
+  - type: web
+    name: peerglass-api
+    runtime: python
+    plan: free                          # upgrade to starter for always-on
+    region: oregon                      # closest to RIR servers (ARIN/APNIC)
+    branch: main
+    buildCommand: pip install -r requirements.txt
+    startCommand: uvicorn api:app --host 0.0.0.0 --port $PORT
+    healthCheckPath: /v1/meta/status
+
+    envVars:
+      # CORS — set to your frontend domain in production
+      # e.g. "https://your-username.github.io" or "*" for open access
+      - key: PEERGLASS_ALLOWED_ORIGINS
+        value: "*"
+
+      # Optional — enables GreyNoise threat classification
+      # Free API key: https://www.greynoise.io/plans/community
+      - key: GREYNOISE_API_KEY
+        sync: false                     # set manually in Render dashboard
+
+    autoDeploy: true                    # redeploy on every push to branch
+
+  # ── Web UI (uncomment after Sprint 7 builds the React UI) ────
+  # - type: web
+  #   name: peerglass-ui
+  #   runtime: static
+  #   plan: free                        # static sites never sleep
+  #   branch: main
+  #   buildCommand: cd ui && npm ci && npm run build
+  #   staticPublishPath: ui/dist
+  #   pullRequestPreviewsEnabled: true
+  #   headers:
+  #     - path: /*
+  #       name: X-Frame-Options
+  #       value: DENY
+  #     - path: /*
+  #       name: X-Content-Type-Options
+  #       value: nosniff
+  #   routes:
+  #     - type: rewrite
+  #       source: /*
+  #       destination: /index.html      # SPA fallback for client-side routing

requirements.txt

@@ -0,0 +1,13 @@
+# PeerGlass — Python dependencies
+# Generated from pyproject.toml for Render.com and other pip-based deployments.
+#
+# Install: pip install -r requirements.txt
+# Dev install (editable): pip install -e .
+
+mcp[cli]>=1.0.0
+httpx>=0.27.0
+pydantic>=2.0.0
+fastapi>=0.110.0
+uvicorn[standard]>=0.27.0
+slowapi>=0.1.9
+dnspython>=2.4.0